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1-6 (Canceled) 

7. (Currently Amended) A method for detecting unauthorized access of a cable system by a 
cable modem auxiliary device (CMAD ), the method comprising: 

receiving at a cable modem termination system (CMTS) a DHCP request comprising a 

MAC address of a CMAD seeking access to the cable system and a MAC address of a 

cable modem (CM) to which the CMAD is connected; 
forming a proffered identifier of the CMAD by combining a gateway interface address of 

the CMTS with the CM MAC address and the CMAD MAC address; 
comparing the components of the proffered identifier to the components of each of one or 

more stored identifiers stored in a datastore; 
making a determination whether the proffered identifier and any of the one or more 

stored identifiers satisfy a matching criteria comprising a same CMAD MAC address 

component and a different gateway interface address component; and 
in the event the proffered identifier and any of the one or more stored identifiers satisfy 

the matching criteria, selecting a remedial response , wherein the remedial response 

comprises denying the CMAD access to the cable system . 

8. (Original) The method for detecting unauthorized access of a cable system by a CMAD 
of claim 7, wherein the datastore comprises a central database. 

9. (Original) The method for detecting unauthorized access of a cable system by a CMAD 
of claim 7, wherein the datastore comprises a distributed database. 

10. (Original) The method for detecting unauthorized access of a cable system by a CMAD 
of claim 7, wherein the cable system comprises a DHCP server linked to the CMTS and wherein 
the DHCP server makes the determination with respect to the matching criteria. 

1 1 . (Currently Amended) The method for detecting unauthorized access of a cable system by 
a CMAD of claim 7, wherein the remedial response further comprises d e nying th e CMAD acc e ss 
to the cabl e syst e m , sending an advisory message to a network manager^and and recording the 
event in a log file. 

12. (Currently Amended) A method for detecting unauthorized access of a cable system by a 
CMAD , wher e in the m e thod compris e s comprising : 
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receiving at a cable modem termination system (CMTS) a DHCP request comprising a 

MAC address of a CMAD seeking access to the cable system and a MAC address of a 

cable modem (CM) to which the CMAD is connected; 
forming a proffered identifier of the CMAD by combining a gateway interface address of 

the CMTS with the CM MAC address and the CMAD MAC address; 
comparing the components of the proffered identifier to the components of each of one or 

more stored identifiers stored in a datastore; 
making a determination whether the proffered identifier and any of the one or more 

stored identifiers satisfies a matching criteria comprising a same CMAD MAC 

address component, a different CM MAC address component, and a same gateway 

interface address component; and 
in the event the proffered identifier and any of the one or more stored identifiers satisfy 

the matching criteria, selecting a remedial response , wherein the remedial response 

comprises denying the CMAD access to the cable system . 

13. (Original) The method for detecting unauthorized access of a cable system by a CMAD 
of claim 12, wherein the datastore comprises a central database. 

14. (Original) The method for detecting unauthorized access of a cable system by a CMAD 
of claim 12, wherein the datastore comprises a distributed database. 

15. (Original) The method for detecting unauthorized access of a cable system by a CMAD 
of claim 12, wherein the cable system further comprises a DHCP server linked to the CMTS and 
wherein the DHCP server makes the determination with respect to the matching criteria. 

1 6. (Currently Amended) The method for detecting unauthorized access of a cable system by 
a CMAD of claim 12, wherein the remedial response furthercomprises d e nying the CMAD 
acc e ss to th e cabl e syst e m, sending an advisory message to a network manager^aad and 
recording the event in a log file. 

1 7. (Currently Amended) A method for detecting unauthorized access of a cable system by a 
cable modem auxiliary device (CMAD) , the m e thod comprising: 

receiving at a cable modem termination system (CMTS) a DHCP request comprising a 
MAC address of a CMAD seeking access to the cable system and a MAC address of a 
cable modem (CM) to which the CMAD is connected; 
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forming a proffered identifier of the CMAD by combining a gateway interface address of 
the CMTS with the CM MAC address and the CMAD MAC address; 

comparing the components of the proffered identifier to the components of each of one or 
more stored identifiers stored in a datastore; 

making a first determination whether the proffered identifier and any of the one or more 
stored identifiers satisfy a first matching criteria comprising a same CMAD MAC 
address component and a different gateway interface address component; 

in the event the proffered identifier and any of the one or more stored identifiers satisfy 
the first matching criteria, selecting a remedial response , wherein the remedial 
response comprises denying the CMAD access to the cable system ; 

in the event the proffered identifier and any of the one or more stored identifiers do not 
satisfy the first matching criteria, making a second determination whether the 
proffered identifier and any of the one or more stored identifiers satisfies a second 
matching criteria comprising a same CMAD MAC address component, a different 
CM MAC address component, and a same gateway interface address component; and 

in the event the proffered identifier and any of the one or more stored identifiers satisfy 
the second matching criteria, selecting a remedial response , wherein the remedial 
response comprises denying the CMAD access to the cable system . 

1 8. (Original) The method for detecting unauthorized access of a cable system by a CMAD 
of claim 17, wherein the datastore comprises a central database. 

1 9. (Original) The method for detecting unauthorized access of a cable system by a CMAD 
of claim 17, wherein the datastore comprises a distributed database. 

20. (Original) The method for detecting unauthorized access of a cable system by a CMAD 
of claim 17, wherein the cable system further comprises a DHCP server linked to the CMTS and 
wherein the DHCP server makes the determination with respect to the first matching criteria and 
the determination with respect to the second matching criteria. 

2 1 . (Currently Amended) The method for detecting unauthorized access of a cable system by 
a CMAD of claim 17, wherein the remedial response further comprises d e nying th e CMAD 
access to th e cable syst e m, sending an advisory message to a network manager^-and and 
recording the event in a log file. 

22. (Currently Amended) The method for detecting unauthorized access of a cable system by 
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a CMAD of claim 1 7 . wher e in the m e thod further compris e s further comprising in the event that 
the proffered identifier and any of the one or more stored identifiers do not satisfy the first 
matching criteria and the second matching criteria, storing the proffered identifier in the 
datastore. 

23. (Currently Amended) A method for detecting unauthorized access of a cable system by a 
cable modem auxiliary device (CMAD), wherein the cable system comprises a plurality of 
regional cable networks each having a regional datastore, the method comprising: 

receiving at a cable modem termination system (CMTS) a DHCP request comprising a 
MAC address of a CMAD seeking access to one of the plurality of regional cable 
networks and a MAC address of a cable modem (CM) to which the CMAD is 
connected; 

forming a proffered identifier of the CMAD by combining a gateway interface address of 
the CMTS with the proffered CM MAC address and the proffered CMAD MAC 
address; 

comparing the components of the proffered identifier to the components of each of one or 

more stored identifiers stored in a regional datastore; 
making a first determination whether the proffered identifier and any of the one or more 

regionally stored identifiers satisfy a first matching criteria comprising a same 

CMAD MAC address component and a different gateway interface address 

component; 

in the event the proffered identifier and any of the one or more regionally stored 
identifiers satisfy the matching criteria, selecting a remedial response , wherein the 
remedial response comprises denying the CMAD access to the cable system ; 

in the event the proffered identifier and any of the one or more regionally stored 

identifiers do not satisfy the first matching criteria, making a second determination 
whether the proffered identifier and any of the one or more regionally stored 
identifiers satisfies a second matching criteria comprising a same CMAD MAC 
address component, a different CM MAC address component, and a same gateway 
interface address component; 

in the event the proffered identifier and any of the one or more regionally stored 

identifiers satisfy the second matching criteria, selecting a remedial response , wherein 
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the remedial response comprises denying the CMAD access to the cable system ; 

in the event that the proffered identifier and any of the one or more regionally stored 
identifiers do not satisfy the first matching criteria and the second matching criteria, 
comparing the components of the proffered identifier to the components of each of 
one or more stored identifiers stored in a central datastore, wherein the central 
datastore comprises regionally stored identifiers from each of the regional datastores; 

making a third determination whether the proffered identifier and any of the one or more 
centrally stored identifiers satisfy the first matching criteria comprising; 

in the event the proffered identifier and any of the one or more centrally stored identifiers 
satisfy the first matching criteria, selecting a remedial response , wherein the remedial 
response comprises denying the CMAD access to the cable system : 

in the event the proffered identifier and any of the one or more centrally stored identifiers 
do not satisfy the first matching criteria, making a fourth determination whether the 
proffered identifier and any of the one or more centrally stored identifiers satisfies the 
second matching criteria; and 

in the event the proffered identifier and any of the one or more centrally stored identifiers 
satisfy the second matching criteria, selecting a remedial response , wherein the 
remedial response comprises denying the CMAD access to the cable system . 

24. (Original) The method for detecting unauthorized access of a cable system by a CMAD 
of claim 23, wherein the regional datastore and the central datastore each comprise a central 
database. 

25. (Original) The method for detecting unauthorized access of a cable system by a CMAD 
of claim 23, wherein the regional datastore and the central datastore each comprise a distributed 
database. 

26. (Original) The method for detecting unauthorized access of a cable system by a CMAD 
of claim 23, wherein at least one of the plurality of regional cable networks further comprises a 
DHCP server linked to the CMTS and wherein the DHCP server makes the first determination 
and the second determination. 

27. (Currently Amended) The method for detecting unauthorized access of a cable system by 
a CMAD of claim 23, wherein the remedial response further comprises denying th e CMAD 




;nding an advisory message to a network manager r and_and 
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recording the event in a log file. 

28. (Currently Amended) The method for detecting unauthorized access of a cable system by 
a CMAD of claim 23 . wh e r e in the m e thod further compris e s further comprising in the event that 
the proffered identifier and any of the one or more centrally stored identifiers do not satisfy the 
first matching criteria and the second matching criteria, storing the proffered identifier in the 
regional datastore and the central datastore. 
29-35 (Canceled) 

36. (Currently Amended) A system for detecting unauthorized access of a cable network by 
a cable mod e m. modem auxiliary device (CMAD) the system comprising: 

a CMTS 1 adapt e d to wherein the CMTS comprises instructions for : 

feeeiv ereceiving a DHCP request comprising a MAC address of a CMAD seeking access 
to the cable system and a MAC address of a cable modem (CM) to which the CMAD 
is connected; and 

feBB -forming a proffered identifier by combining a gateway interface address of the 
CMTS with the CM MAC address and the CMAD MAC address; and 
a detection server linked to a datastore, wherein the detection server adapt e d to comprises 
instructions for : 

geeeiv ereceiving the proffered identifier from the CMTS; 

compar e c omparing the components of the proffered identifier to the components of each 
of one or more stored identifiers stored in the datastore; 

determin e determining whether the proffered identifier and any of the one or more stored 
identifiers satisfy a first matching criteria comprising a same CMAD MAC address 
component and a different gateway interface address component; and 

in the event the proffered identifier and any of the one or more stored identifiers satisfy 
the first matching criteria, seiee tselecting a remedial response , wherein the remedial 
response comprises denying the CMAD access to the cable system . 

37. (Currently Amended) The system of claim 36, wherein the detection server is furth e r 
adapt e d to further comprises instructions for : 

d e t e rmine determining whether the proffered identifier and any of the one or more stored 
identifiers satisfies a second matching criteria comprising a same CMAD MAC 
address component, a different CM MAC address component, and a same gateway 
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interface address component; and 
in the event the proffered identifier and any of the one or more stored identifiers satisfy 
the second matching criteria, seteetsejecting a remedial response , wherein the 
remedial response comprises denying the CMAD access to the cable system . 

38. (Currently Amended) The system of claim 36, wherein the detection server is further 
adapt e d to further comprises instructions for in the event the proffered identifier and any of the 
one or more stored identifiers do not satisfy the first matching criteria and the second matching 
criteria, store -storing the proffered identifier in the datastore. 

39. (Original) The system of claim 36, wherein the datastore comprises a central database. 

40. (Original) The system of claim 36, wherein the datastore comprises a distributed 
database. 

41 . (Original) The system of claim 36, wherein the remedial response comprises denying the 
CMAD access to the cable system, sending an advisory message to a network manager, and 
recording the event in a log file. 

42. (Original) The system of claim 36, wherein the detection server comprises a DHCP 
server. 

43. (Currently Amended) A system for detecting unauthorized access of a cable network 
comprising a plurality of regional cable networks by a cable modem auxiliary device (CMAD); 
the system comprising: 

a CMTS A adapt e d to wherein the CMTS comprises instructions for : 

feeeiv ereceiving a DHCP request comprising a MAC address of a CMAD seeking access 
to one of the plurality of regional cable networks and a MAC address of a cable 
modem (CM) to which the CMAD is connected; and 
ferm forming a proffered identifier by combining a gateway interface address of the 
CMTS with the CM MAC address and the CMAD MAC address; and 
a regional detection server linked to a regional datastore, wherein the regional detection server 
adapted to comprises instructions for : 

feeeiv ereceiving the proffered identifier from the CMTS; 

compar e comparing the components of the proffered identifier to the components of each 
of one or more stored identifiers stored in the regional datastore; 
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ietermining whether the proffered identifier and any of the one or more 



regionally stored identifiers satisfy a first matching criteria comprising a same 
CMAD MAC address component and a different gateway interface address 
component; 

in the event the proffered identifier and any of the one or more regionally stored 
identifiers satisfy the first matching criteria, seiee tselecting a remedial response a 
wherein the remedial response comprises denying the CMAD access to the cable 
system : 

in the event the proffered identifier and any of the one or more regionally stored 

identifiers do not satisfy the first matching criteria, d e termine determining whether the 
proffered identifier and any of the one or more regionally stored identifiers satisfies a 
second matching criteria comprising a same CMAD MAC address component, a 
different CM MAC address component, and a same gateway interface address 
component; 

in the event the proffered identifier and any of the one or more regionally stored 

identifiers satisfy the second matching criteria, setee tselecting a remedial response^ 
wherein the remedial response comprises denying the CMAD access to the cable 
system ; 

in the event that the proffered identifier and any of the one or more regionally stored 
identifiers do not satisfy the first matching criteria and the second matching criteria, 
sen dsending the proffered identifier to a central detection server; and 
the central detection server linked to a central datastore, the central detection server adapted 
te comprising instructions for : 

eompar e comparing the components of the proffered identifier to the components of each 
of one or more stored identifiers stored in a central datastore, wherein the central 
datastore comprises regionally stored identifiers from each of the regional datastores; 

det e rmine determining whether the proffered identifier and any of the one or more 
centrally stored identifiers satisfy the first matching criteria; 

in the event the proffered identifier and any of the one or more centrally stored identifiers 
satisfy the first matching criteria, selee tselecting a remedial response; 

in the event the proffered identifier and any of the one or more centrally stored identifiers 
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do not satisfy the first matching criteria, d e t e rmine determininR whether the proffered 
identifier and any of the one or more centrally stored identifiers satisfies the second 
matching criteria; and 

in the event the proffered identifier and any of the one or more centrally stored identifiers 
satisfy the second matching criteria, seteet selecting a remedial response , wherein the 
remedial response comprises denying the CMAD access to the cable wherein system . 

44. (Currently Amended) The system of claim 43, wherein the central detection serv e r is 
further adapted to further comprises instructions for in the event the proffered identifier and any 
of the one or more centrally stored identifiers do not satisfy the first matching criteria and the 
second matching criteria, stefe -storing t he proffered identifier in the regional datastore and the 
central datastore. 

45. (Original) The system of claim 43, wherein the regional datastore and the central 
datastore each comprise a central database. 

46. (Original) The system of claim 43, wherein the regional datastore and the central 
datastore each comprise a distributed database. 

47. (Currently Amended) The system of claim 43, wherein the remedial response further 
comprises denying the CMAD acc e ss to th e cable syst e m, sending an advisory message to a 
network manager^-and and recording the event in a log file. 

48. (Original) The system of claim 43, wherein the regional detection server comprises a 
DHCP server. 

49-51 (Canceled) 

52. (New) The method for detecting unauthorized access of a cable system by a CMAD of 
claim 7 further comprising in the event that the proffered identifier and any of the one or more 
stored identifiers do not satisfy the matching criteria, storing the proffered identifier in the 
datastore. 

53. (New) The method for detecting unauthorized access of a cable system by a CMAD of 
claim 12 further comprising in the event that the proffered identifier and any of the one or more 
stored identifiers do not satisfy the matching criteria, storing the proffered identifier in the 
datastore. 
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